> Why take the risk? You don't know what the attacker actually did
> until you do some analysis. If you do analysis before capturing a
> disk image, you're destroying evidence.
>
> Rebuilding a server is not hard. It has a known quantity of effort
> involved and reliably prevents further intrusion which leverages the
> access previously gained.
>
> On the other hand, conducting an investigation to the point where you
> are reasonably sure an attacker can't continue to leverage that access
> costs a lot of time and money.
I'm conflicted here, though I do agree with what you say. A simple attack
lacking any sophistication whose goal is simply to drop an IRC bot and nothing
more may result in undue expense through effort and analysis. Conversely,
assuming that former does not confirm the scope of attack or impact... I'm
conflicted but I agree with your assessment.
Perhaps in this situation one would be more likely to fall back on the output
of the defense in depth tools previously recommended. In this case they are
not available so perhaps caution is wise as you have suggested.
I think it reasonable to assume a documented and vulnerable out of date
world-accessible version of PHPMyAdmin is likely the initial attack vector.
The Apache/PHP logs should prove this to be the case, so rebuilding a box and
disabling PHPMyAdmin may be a reasonable response to this incident without the
need for forensic analysis... depending on the organization. If this box is a
singular VPS I think it reasonable, if it's a part of a larger system which
could be leveraged as a launching platform to attack other LAN or
organizational-owned boxes then by all means a comprehensive analysis should be
undertaken.
Tim thanks for your thoughts and reply.
Thanks,
John
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
